A system and method for testing the security of symmetric cryptographic components

Abstract

The present invention discloses a system and method for testing the security of a symmetric cryptographic component. The system comprises: an S-box testing module for testing the cryptographic performance of the S-box of the symmetric cryptographic component, comprising a differential uniformity submodule, a nonlinearity submodule, a fixed point number submodule, an algebraic degree and term number submodule, an algebraic immunity submodule, an avalanche submodule, and a diffusion submodule; a P permutation testing module for testing the diffusion performance of the P permutation of the symmetric cryptographic component, comprising a demonstration submodule, a binary field matrix testing submodule, a GF(2 n ) matrix testing submodule; and a minimum diffusion round number testing module, which is used to test the minimum diffusion round number and corresponding stringing of the generalized Feistel structure of the symmetric cryptographic component. This system innovates the calculation methods for related indicators such as S-boxes, P permutations, minimum diffusion round number, and stringing, improving testing efficiency and accuracy.

Description

Technical Field

[0001] The present invention relates to the fields of computer technology and information security, and in particular to a system and method for testing the security of symmetric cryptographic components. Background Art

[0002] Modern cryptographic systems are generally divided into two categories: symmetric and asymmetric. Symmetric ciphers offer advantages such as high speed, small storage requirements, and ease of hardware and software implementation. They are widely used in data encryption and authentication, such as file transfer, network communications, and database security. Symmetric ciphers primarily include block ciphers, hash functions, and stream ciphers. With the continuous advancement of algorithm design and analysis techniques, the basic components of different symmetric ciphers are becoming increasingly similar. The most commonly used are S-boxes and P-permutations, nonlinear transformation S-boxes, and linear diffusion P-permutations. The security of S-boxes and P-permutations plays a key role in supporting the security of cryptographic algorithms. Regarding the overall structure of cryptographic algorithms, the minimum number of diffusion rounds was proposed by Suzaki T. and Minematsu K. (Improving the generalized Feistel [C] / / International Workshop on Fast Software Encryption. Springer, Berlin, Heidelberg, 2010: 19-39). The minimum number of diffusion rounds determines the resource utilization and implementation efficiency of cryptographic algorithms, making security metrics testing of subcomponents of symmetric ciphers crucial. Summary of the Invention

[0003] In view of this, the present invention provides a system and method for testing the security of symmetric cryptographic components, which can solve the technical problem of determining the security of symmetric cryptographic components.

[0004] In order to solve the above technical problems, the present invention is implemented as follows.

[0005] A system for testing the security of a symmetric cryptographic component, comprising:

[0006] An S-box testing module, which is used to test the cryptographic performance of the S-box of the symmetric cryptographic component. The S-box testing module includes a differential uniformity submodule, a nonlinearity submodule, a fixed point number submodule, an algebraic degree and number of terms submodule, an algebraic immunity submodule, an avalanche submodule, and a diffusion submodule;

[0007] P permutation test module, the P permutation test module is used to test the diffusion performance of the symmetric cryptographic component P permutation, the P permutation test module includes a demonstration submodule, a binary domain matrix test submodule, a GF(2 n )Matrix test submodule;

[0008] A minimum diffusion round number test module is used to test the minimum diffusion round number and corresponding pull line of the generalized Feistel structure of the symmetric cryptographic component.

[0009] Preferably, the S-box testing module receives the input size, output size, and content of the S-box of the symmetric cryptographic component to be tested, wherein the input size refers to the number of bits of the input data of the S-box, the output size refers to the number of bits of the output data of the S-box, and the content of the S-box refers to the specific values of the input data and output data of the S-box; the input of the S-box is recorded as the independent variable x, and the output is recorded as the dependent variable y; the S-box of the symmetric cryptographic component to be tested receives the values of the parameters corresponding to the S-box.

[0010] Preferably, the differential uniformity submodule is configured to receive a first input value, the first input value including an input differential of the contents of the S-box, an output differential of the contents of the S-box, an S-box independent variable x, and an S-box dependent variable y; and calculate the received first input value:

[0011] For each set of values (i, j) of input difference and output difference, traverse the S-box independent variable x and calculate the value

[0012]

[0013] Among them, GF(2) n represents an n-dimensional vector on a binary field, represents the exclusive-or operation, || represents the operation on the number of elements, S(x) is the content of the S-box, i is the i-th row of the input difference, j is the j-th column of the output difference, n is the input size of the S-box, and m is the output size of the S-box;

[0014] Each value of λ obtained ij Fill in the matrix to form the differential distribution table of the S box, that is

[0015]

[0016] After removing the first row from the differential distribution table Λ(S) of the S-box, the largest non-zero value among the remaining values is the differential uniformity of the S-box; output the differential distribution table Λ(S) and the differential uniformity of the S-box;

[0017] The nonlinearity submodule is configured to receive a second input value, the second input value including an S-box input mask, an output mask, an S-box independent variable x, and an S-box dependent variable y, and calculate the received second input value to output a first linear distribution table L1(S), a second linear distribution table L2(S), and a nonlinearity;

[0018] The calculating the received second input value includes:

[0019] For each set of values (u, v) of the input mask and the output mask, traverse the S-box argument x and calculate each value in the first linear distribution table L1(S):

[0020]

[0021] Among them, GF(2) n represents an n-dimensional vector on a binary field, represents the exclusive-or operation, || represents the operation of the number of elements; S(x) is the content of the S-box, the dot product represents the inner product operation of two vectors, u is the value of the S-box input mask, v is the value of the S-box output mask, n is the S-box input size, and m is the S-box output size;

[0022] Each value n1 obtained uv Fill in an n×m matrix to form the first linear distribution table of the S-box, that is,

[0023]

[0024] For each set of values (u, v) of the input mask and the output mask, traverse the S-box independent variable x and calculate each value in the second linear distribution table L2(S):

[0025]

[0026] Among them, GF(2) n represents an n-dimensional vector on a binary field, represents the exclusive OR operation, and || represents the operation of the number of elements;

[0027] Each value n2 obtained uv Fill in the second n×m matrix to form the second linear distribution table of the S box, that is,

[0028]

[0029] The smallest non-zero integer in L1(S) and L2(S) is the S-box nonlinearity, and the first linear distribution table L1(S), the first linear distribution table L2(S) and the S-box nonlinearity are output;

[0030] The fixed point number submodule is used to receive a third input value, which includes an S-box independent variable x and an S-box dependent variable y, and calculate the received third input value:

[0031] Traverse the S-box independent variable x and calculate the number t of the corresponding S-box dependent variable y that is equal to x.

[0032] t=|{x=y,x∈GF(2) n , y∈GF(2)m}|

[0033] Among them, GF(2) n and GF(2) m Respectively represent n-dimensional and m-dimensional vectors on binary fields, || represents the operation of the number of elements;

[0034] The number t where x and y are equal is the number of fixed points of the S-box. Output the number of fixed points of the S-box.

[0035] Preferably, the algebraic degree and number of terms submodule is used to receive a fourth input value, wherein the fourth input value includes an S-box independent variable x and an S-box dependent variable y;

[0036] Calculate the received fourth input value:

[0037] Based on the S-box independent variable x and S-box dependent variable y, traverse the S-box independent variable x to obtain the equation group corresponding to each output bit of the S-box. Each equation group contains 2 n equations, solve m Boolean functions f(x) based on m equations;

[0038]

[0039] Where x=(x1,…,x n ), x1,…,x n is the n components corresponding to the S-box independent variable x; a0 is the coefficient of the 0th order term, for The coefficient of the term, f(x) is a Boolean function with n-bit input and 1-bit output,

[0040] The degree of the highest-order term in f(x) is defined as the algebraic degree of f(x), that is, the algebraic degree D(f) is

[0041]

[0042] The number of p-order terms in f(x) is called the p-order terms of f(x), and the sum of all terms is called the number of terms of f(x), that is, the algebraic term number N(f) is

[0043]

[0044] The S-box dependent variable y is m bits, and the S-box dependent variable y corresponds to m Boolean functions S1(x), S2(x),…, S m (x), combine these m Boolean functions to get all 2 m Boolean functions, the Boolean function with the smallest degree is the S-box algebraic degree, that is

[0045]

[0046] Where D is the algebraic degree of the input function corresponding to the S-box, S is the m-component Boolean function output by the S-box, β is the mask output by the S-box, GF(2) m is an m-dimensional vector on a binary field, ⊕ is an XOR operation, b io is the component of β, β=(b1,…,b m ),io is a variable;

[0047] The number of terms of the Boolean function with the smallest number of terms is the number of terms of the S-box, that is,

[0048]

[0049] Where N is the number of algebraic terms of the input function corresponding to the S-box, β is the output mask of the S-box, GF(2) m is an m-dimensional vector on a binary field, is the XOR operation, b io is the component of β, β=(b1,…,b m ).

[0050] Preferably, the algebraic immunity submodule is used to receive a fifth input value, the fifth input value including an S-box independent variable x and an S-box dependent variable y, and calculate the received fifth input value to obtain and output algebraic immunity;

[0051] The calculating the received fifth input value includes:

[0052] According to the input S-box independent variable x and S-box dependent variable y, we can get the m Boolean expressions S1(x), S2(x),…, S m (x), for every Boolean function S num (x), calculate so that S num (x)g(x)=0 or The minimum algebraic degree of a non-zero Boolean function g(x) that holds true, where 1≤num≤m;

[0053] Define the Boolean function S num The set of zero operators of (x) is Ann(S num )={g(x)∈B n [x]|S num g=0,g(x)≠0},S num (x) Algebraic Immunity AI(S num )for

[0054]

[0055] Among them B n [x] represents the set of all n-ary Boolean functions, deg represents the algebraic degree, and g is Snum (x) of the zero operator g(x), Ann(S num ) is the set of these zero operators;

[0056] The S-box dependent variable y is m bits, and the S-box dependent variable y corresponds to m Boolean functions S1(x), S2(x),…, S m (x), combine these m Boolean functions to get all 2 m Boolean functions, replace the AI (β·S) with the smallest algebraic immunity as the S-box algebraic immunity, that is

[0057]

[0058] Among them, · represents the inner product operation, and sum is a variable;

[0059] The avalanche submodule is used to receive a sixth input value, the sixth input value including an S-box independent variable x and an S-box dependent variable y, and perform avalanche characteristic calculation on the sixth input value to obtain and output the avalanche characteristic;

[0060] The calculating the sixth input value includes:

[0061] The S-box dependent variable y is m bits, and the S-box dependent variable y corresponds to m Boolean functions S1(x), S2(x),…, S m (x), change 1 bit of the input, e is an n-dimensional unit vector, traverse the S-box independent variable x, S num (x) is a Boolean function, calculating m S num The output of (x) is the number of bits that have changed compared to the unchanged input, that is:

[0062]

[0063] Among them, GF(2) n represents an n-dimensional vector on a binary field, Indicates exclusive OR operation, W H (e) represents the number of non-zero bits in the variable e;

[0064] like Then the S-box satisfies the avalanche criterion; otherwise, it is determined that the S-box does not satisfy the avalanche criterion;

[0065] The diffusion submodule is used to receive a seventh input value, the seventh input value including an S-box independent variable x and an S-box dependent variable y, and calculate the received seventh input value to obtain and output a diffusion characteristic;

[0066] The calculating the received seventh input value includes:

[0067] According to the input S-box independent variable x and S-box dependent variable y, we can get the m Boolean expressions S1(x), S2(x),…, S m (x), for each Boolean function, traverse the S-box variable x, for each sum, 1≤sum≤m, judge Is it a balanced function?

[0068]

[0069] α∈GF(2) n :1≤W H (α)≤k

[0070] Among them, GF(2) n represents an n-dimensional vector on a binary field, Indicates exclusive OR operation, W H (α) represents the number of non-zero bits in the variable α, and k is the number of bits such that Balanced W H (α) maximum value;

[0071] For each sum, 1≤sum≤m, if each If both are equilibrium functions, then the S-box satisfies the k-times diffusion criterion; otherwise, the S-box does not satisfy the k-times diffusion criterion.

[0072] Preferably, the P permutation test module includes a demonstration submodule, a binary domain matrix test submodule, a GF(2 n )Matrix test submodule, where:

[0073] The demonstration submodule is used to demonstrate the branch number test of P permutation, receive an eighth input value, and the eighth input value is an algorithm name, and trigger the binary domain matrix test submodule or the GF(2 n ) Matrix test submodule and display the results;

[0074] The binary field matrix test submodule is used to receive a ninth input value, where the ninth input is a coefficient matrix corresponding to the P permutation. When the coefficient matrix is a matrix over the binary field GF(2), the submodule obtains the dimension dim of the coefficient matrix and the element Matrix[enrty][enrty] of the coefficient matrix, calculates and outputs the number of first matrix branches;

[0075] The calculating of the number of branches of the first matrix includes:

[0076] Step S11: For the input dim dim-dimensional column vector Filling unit vectors e1,...,e dim , we get [X1,...,X dim,e1,...,e dim ];in, is a dim-dimensional column vector on a binary field, is a dim-dimensional column vector on a binary field;

[0077] Step S12: For [X1,...,X dim ,e1,...,e dim ] are combined and XORed. For 2≤l0≤dim, l0 vectors are selected for XORing. If the XOR value is not 0, l0 is assigned to l0+1 and the process goes to step S12. If the XOR value is 0, the process goes to step S13.

[0078] Step S13: outputting the number of differential branches to 10;

[0079] The GF(2 n ) matrix test submodule is used to receive the tenth input value, the tenth input is the coefficient matrix corresponding to the P permutation, the coefficient matrix multivariate domain GF(2 n ) on the matrix, then get GF(2 n ) domain, the degree n of the irreducible polynomial corresponding to the domain, the array irrp[t] consisting of the coefficients of the irreducible polynomial, the dimension dim of the coefficient matrix, and the element Matrix[MAX][MAX] of the coefficient matrix, and calculate and output the number of branches of the second matrix;

[0080] The calculation to obtain the number of branches of the second matrix includes:

[0081] Step S21: For the input dim dim-dimensional column vectors [X1,...,X dim ],X ip ∈(GF(2 n )) dim ,1≤ip≤dim, fill with unit vectors e1,...,e dim , we get [X1,...,X dim ,e1,...,e dim ]; where GF(2 n ) is the finite field on which P permutation is based, (GF(2 n )) dim is GF(2 n ) domain dim-dimensional vector;

[0082] Step S22: For [X1,...,X dim ,e1,...,e dimPerform Gaussian elimination on the 2*dim vectors. For 2 ≤ l1 ≤ dim, traverse and select l1 vectors for Gaussian elimination. If the l1 vectors are linearly independent, assign l1 = l1 + 1 and go to step S22; otherwise, go to step S23;

[0083] Step S23: Output the differential branch number as l1.

[0084] Preferably, the minimum diffusion round number testing module is used to test the minimum diffusion round number and the corresponding pull wire of the generalized Feistel structure of the symmetric cipher component; the minimum diffusion round number testing module receives the eleventh input data, and the eleventh input data is the number of blocks q, where q is an even number;

[0085] The calculation method for the minimum diffusion round number and the corresponding pull wire of the generalized Feistel structure of the symmetric cipher component is as follows:

[0086] Step S31: For the input q, set r = q, and let the permutation δ be δ ii ;

[0087] Step S32: If q alternative diffusion round numbers Re jj have been obtained, go to step S35; otherwise, let Y = [Y0, Y1,... Y q-1 = e jj , where Y0, Y1,... Y q-1 are the q components of Y, and e jj is a q-dimensional vector with the jj-th component being 1 and the other components being 0;

[0088] Step S33: Perform the following R-round operation on the input Y = [Y0, Y1,... Y q-1 :

[0089] [Y0, Y1,... Y q-1 Keep the values of the odd positions unchanged, and perform an OR operation on the even positions with the odd positions to obtain [Y′0, Y′1,... Y′ q-1 ;

[0090] After permutation δ ii move the corresponding blocks of [Y′0, Y′1,... Y′ q-1 to obtain [Z0, Z1,... Z q-1 ;

[0091] Update Y to [Z0, Z1,... Z q-1 ;

[0092] If the q components of [Y0, Y1,... Y q-1 are not all 1 and R < q, then assign R = R + 1 and go to step S33; otherwise, output the alternative diffusion round number Re jj ;

[0093] Step S34: Assign jj = jj + 1, and enter Step S32;

[0094] Step S35: The diffusion round number R = min{Re jj |1 ≤ jj ≤ q}, and output R and the corresponding wire permutation δ ii ;

[0095] Step S36: If R < r, let r = R. If all permutations have not been processed, update the permutation δ to δ ii+1 , clear the number of alternative diffusion round numbers, and enter Step S32; otherwise, output r and the corresponding permutation δ.

[0096] A method for testing the security of a symmetric cipher component provided by the present invention, the method is based on the system described above, and the method includes:

[0097] Test the cryptographic performance of the S-box of the symmetric cipher component; that is, the S-box test module is used to test the cryptographic performance of the S-box of the symmetric cipher component;

[0098] Test the P-permutation performance of the symmetric cipher component, that is, the P-permutation test module tests the P-permutation performance;

[0099] Test the minimum diffusion round number and corresponding wire of the symmetric cipher component, that is, the minimum diffusion round number test module tests the minimum diffusion round number and corresponding wire of the generalized Feistel structure of the symmetric cipher component.

[0100] Beneficial effects:

[0101] The present invention proposes a symmetric cipher component security index test system and test method. By testing, the differential uniformity, nonlinearity, number of fixed points, algebraic degree and number of terms, algebraic immunity, avalanche effect, diffusion property of the S-box of the symmetric cipher component to be tested, and the binary field matrix, GF(2 n ) matrix of the P-permutation of the symmetric cipher component to be tested, as well as the wire and diffusion round number of the minimum diffusion round number of the generalized Feistel structure to be tested are obtained. Through the data obtained by testing, the security of the symmetric cipher component to be tested can be determined.

[0102] Has the following technical effects:

[0103] (1) Obtain 7 cryptographic security indexes of the S-box to effectively judge the cryptographic security strength of the S-box;

[0104] (2) Obtain the branch number of the P-permutation to effectively judge the local diffusion function of the P-permutation;

[0105] (3) Obtain the minimum number of diffusion rounds and the pull line of the generalized Feistel structure, which provides a reference for the structural design of symmetric cryptographic components;

[0106] (4) The present invention innovates the calculation method of S-box, P substitution, minimum number of diffusion rounds and related indicators of wire pulling, thereby improving test efficiency and test accuracy;

[0107] (5) The calculation method of the above-mentioned related indicators of the present invention is easy to implement industrially. BRIEF DESCRIPTION OF THE DRAWINGS

[0108] Figure 1 A functional diagram for testing the security of symmetric cryptographic components provided by the present invention;

[0109] Figure 2 A schematic diagram of the system structure for testing the security of symmetric cryptographic components provided by the present invention;

[0110] Figure 3 A schematic diagram of the generalized Feistel structure provided by the present invention;

[0111] FIG4(A) is a schematic diagram of the test effect of the S-box differential distribution table provided by the present invention;

[0112] FIG4(B) is a schematic diagram of the test effect of the S-box linear distribution table provided by the present invention;

[0113] FIG4(C) is a schematic diagram showing the test results of an S-box algebraic expression (algebraic degree and number of algebraic terms) provided by the present invention;

[0114] FIG4(D) is a schematic diagram showing the detailed effects of the S-box algebraic immunity test provided by the present invention;

[0115] FIG4(E) is a schematic diagram of the S-box rigorous avalanche effect test effect provided by the present invention;

[0116] FIG4(F) is a schematic diagram of the test results of various indicators of the S-box provided by the present invention;

[0117] FIG4(G) is a schematic diagram showing the effect of the number of branches of the column confusion matrix of AES in the P permutation branch number test provided by the present invention;

[0118] FIG4(H) is a schematic diagram showing the effect of the number of branches of a binary domain matrix in the P permutation branch number test provided by the present invention;

[0119] FIG4(I) is a schematic diagram of the minimum number of diffusion rounds and the corresponding wire drawing test results of a generalized Feistel structure with 8 blocks provided by the present invention;

[0120] Figure 4(J)-Figure 4(L) This is a schematic diagram of the interfaces of the three submodules provided by the present invention: the S-box index test, the P permutation branch number test, and the minimum diffusion round number test. DETAILED DESCRIPTION

[0121] The present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0122] like Figure 1-Figure 2 As shown, the present invention proposes a system for testing the security of a symmetric cryptographic component, the system comprising:

[0123] An S-box testing module, which is used to test the cryptographic performance of the S-box of the symmetric cryptographic component. The S-box testing module includes a differential uniformity submodule, a nonlinearity submodule, a fixed point number submodule, an algebraic degree and number of terms submodule, an algebraic immunity submodule, an avalanche submodule, and a diffusion submodule;

[0124] P permutation test module, the P permutation test module is used to test the diffusion performance of the symmetric cryptographic component P permutation, the P permutation test module includes a demonstration submodule, a binary domain matrix test submodule, a GF(2 n )Matrix test submodule;

[0125] A minimum diffusion round number test module is used to test the minimum diffusion round number and corresponding pull line of the generalized Feistel structure of the symmetric cryptographic component.

[0126] The S-box testing module receives the input size, output size, and contents of the S-box of the symmetric cryptographic component under test. The input size refers to the number of bits of the S-box input data, the output size refers to the number of bits of the S-box output data, and the S-box contents refer to the specific values of the S-box input data and output data. After testing the symmetric cryptographic component under test, the S-box testing module outputs the corresponding test results. The input of the S-box is denoted as the independent variable x, and the output is denoted as the dependent variable y. The S-box of the symmetric cryptographic component under test receives the values of the parameters corresponding to the S-box.

[0127] The differential uniformity submodule is configured to receive a first input value, the first input value including an input differential of the contents of the S-box, an output differential of the contents of the S-box, an S-box independent variable x, and an S-box dependent variable y; and calculate the received first input value:

[0128] For each set of values (i, j) of input difference and output difference, traverse the S-box independent variable x and calculate the value

[0129]

[0130] Among them, GF(2) n represents an n-dimensional vector on a binary field, represents the exclusive-or operation, || represents the operation on the number of elements, S(x) is the content of the S-box, i is the i-th row of the input difference, j is the j-th column of the output difference, n is the input size of the S-box, and m is the output size of the S-box;

[0131] Each value of λ obtained ij Fill in the matrix to form the differential distribution table of the S box, that is

[0132]

[0133] After removing the first row from the S-box differential distribution table Λ(S), the largest non-zero value remaining is the S-box differential uniformity. Output the S-box differential distribution table Λ(S) and the differential uniformity.

[0134] The nonlinearity submodule is configured to receive a second input value, the second input value including an S-box input mask, an output mask, an S-box independent variable x, and an S-box dependent variable y, and calculate the received second input value to output a first linear distribution table L1(S), a second linear distribution table L2(S), and a nonlinearity;

[0135] Calculate the second input value received:

[0136] For each set of values (u, v) of the input mask and the output mask, traverse the S-box argument x and calculate each value in the first linear distribution table L1(S):

[0137]

[0138] Among them, GF(2) n represents an n-dimensional vector on a binary field, represents the exclusive-or operation, || represents the operation of the number of elements; S(x) is the content of the S-box, the dot product represents the inner product operation of two vectors, u is the value of the S-box input mask, v is the value of the S-box output mask, n is the S-box input size, and m is the S-box output size;

[0139] Each value n1 obtained uv Fill in an n×m matrix to form the first linear distribution table of the S-box, that is,

[0140]

[0141] For each set of values (u, v) of the input mask and the output mask, traverse the S-box independent variable x and calculate each value in the second linear distribution table L2(S):

[0142]

[0143] Among them, GF(2) n represents an n-dimensional vector on a binary field, represents the exclusive OR operation, and || represents the operation of the number of elements;

[0144] Each value n2 obtained uv Fill in the second n×m matrix to form the second linear distribution table of the S box, that is,

[0145]

[0146] The smallest non-zero integer in L1(S) and L2(S) is the S-box nonlinearity, and the first linear distribution table L1(S), the first linear distribution table L2(S) and the S-box nonlinearity are output.

[0147] The fixed point number submodule is used to receive a third input value, which includes an S-box independent variable x and an S-box dependent variable y, and calculate the received third input value:

[0148] Traverse the S-box independent variable x and calculate the number t of the corresponding S-box dependent variable y that is equal to x.

[0149] t=|{x=y,x∈GF(2) n ,y∈GF(2) m}|

[0150] Among them, GF(2) n and GF(2) m Respectively represent n-dimensional and m-dimensional vectors on binary fields, || represents the operation of the number of elements;

[0151] The number t where x and y are equal is the number of fixed points of the S-box. Output the number of fixed points of the S-box.

[0152] The algebraic degree and number of terms submodule is used to receive a fourth input value, wherein the fourth input value includes an S-box independent variable x and an S-box dependent variable y;

[0153] Calculate the received fourth input value:

[0154] Based on the S-box independent variable x and S-box dependent variable y, traverse the S-box independent variable x to obtain the equation group corresponding to each output bit of the S-box. Each equation group contains 2 n equations, solving m Boolean functions f(x) based on the m equations;

[0155]

[0156] Where x=(x1,…,x n ), x1,…,x n is the n components corresponding to the S-box independent variable x; a0 is the coefficient of the 0th order term, for The coefficient of the term, f(x) is a Boolean function with n-bit input and 1-bit output,

[0157] The degree of the highest-order term in f(x) is defined as the algebraic degree of f(x), that is, the algebraic degree D(f) is

[0158]

[0159] The number of p-order terms in f(x) is called the p-order terms of f(x), and the sum of all terms is called the number of terms of f(x), that is, the algebraic term number N(f) is

[0160]

[0161] The S-box dependent variable y is m bits, and the S-box dependent variable y corresponds to m Boolean functions S1(x), S2(x),…, S m (x), combine these m Boolean functions to get all 2 m Boolean functions, the Boolean function with the smallest degree is the S-box algebraic degree, that is

[0162]

[0163] Where D is the algebraic degree of the input function corresponding to the S-box, S is the m-component Boolean function output by the S-box, β is the mask output by the S-box, GF(2) m is an m-dimensional vector on a binary field, is the XOR operation, b io is the component of β, β=(b1,…,b m ),io is a variable.

[0164] The number of terms of the Boolean function with the smallest number of terms is the number of terms of the S-box, that is,

[0165]

[0166] Where N is the number of algebraic terms of the input function corresponding to the S-box, β is the output mask of the S-box, GF(2) m is an m-dimensional vector on a binary field, is the XOR operation, b io is the component of β, β=(b1,…,b m ).

[0167] The algebraic immunity submodule is used to receive a fifth input value, the fifth input value including an S-box independent variable x and an S-box dependent variable y, and calculate the received fifth input value to obtain and output algebraic immunity;

[0168] Calculate the received fifth input value:

[0169] According to the input S-box independent variable x and S-box dependent variable y, we can get the m Boolean expressions S1(x), S2(x),…, S m (x), for every Boolean function S num (x), calculate so that S num (x)g(x)=0 or The minimum algebraic degree of a non-zero Boolean function g(x) that holds true, where 1≤num≤m;

[0170] Define the Boolean function S num The set of zero operators of (x) is Ann(S num )={g(x)∈B n [x]|S num g=0,g(x)≠0},S num (x) Algebraic Immunity AI(S num )for

[0171]

[0172] Among them B n [x] represents the set of all n-ary Boolean functions, deg represents the algebraic degree, and g is S num (x) of the zero operator g(x), Ann(S num ) is the set of these zero operators;

[0173] The S-box dependent variable y is m bits, and the S-box dependent variable y corresponds to m Boolean functions S1(x), S2(x),…, S m (x), combine these m Boolean functions to get all 2 m Boolean functions, replace the AI (β·S) with the smallest algebraic immunity as the S-box algebraic immunity, that is

[0174]

[0175] Here, · represents the inner product operation, and sum is a variable.

[0176] The avalanche submodule is used to receive a sixth input value, the sixth input value including an S-box independent variable x and an S-box dependent variable y, and perform avalanche characteristic calculation on the sixth input value to obtain and output the avalanche characteristic;

[0177] Calculate the received sixth input value:

[0178] The S-box dependent variable y is m bits, and the S-box dependent variable y corresponds to m Boolean functions S1(x), S2(x),…, S m (x), change 1 bit of the input, e is an n-dimensional unit vector, traverse the S-box independent variable x, S num (x) is a Boolean function, calculating m Snum The output of (x) is the number of bits that have changed compared to the unchanged input, that is:

[0179]

[0180] Among them, GF(2) n represents an n-dimensional vector on a binary field, Indicates exclusive OR operation, W H (e) represents the number of non-zero bits in the variable e;

[0181] like Then the S-box satisfies the avalanche criterion; otherwise, it is determined that the S-box does not satisfy the avalanche criterion.

[0182] The diffusion submodule is used to receive a seventh input value, the seventh input value including an S-box independent variable x and an S-box dependent variable y, and calculate the received seventh input value to obtain and output a diffusion characteristic;

[0183] Calculate the seventh input value received:

[0184] According to the input S-box independent variable x and S-box dependent variable y, we can get the m Boolean expressions S1(x), S2(x),…, S m (x), for each Boolean function, traverse the S-box variable x, for each sum, 1≤sum≤m, judge Is it a balanced function?

[0185]

[0186] α∈GF(2) n :1≤W H (α)≤k

[0187] Among them, GF(2) n represents an n-dimensional vector on a binary field, Indicates exclusive OR operation, W H (α) represents the number of non-zero bits in the variable α, and k is the number of bits such that Balanced W H (α) maximum value;

[0188] For each sum, 1≤sum≤m, if each If both are equilibrium functions, then the S-box satisfies the k-times diffusion criterion; otherwise, the S-box does not satisfy the k-times diffusion criterion.

[0189] The P permutation test module includes a demonstration submodule, a binary domain matrix test submodule, a GF(2 n )Matrix test submodule, where:

[0190] The demonstration submodule is used to demonstrate the branch number test of P permutation, receive an eighth input value, and the eighth input value is an algorithm name, and trigger the binary domain matrix test submodule or the GF(2 n )Matrix test submodule and display the results.

[0191] For example, if the algorithm name is E2, AES, Camelia, or ARIR, the binary domain matrix test submodule is triggered when the algorithm name is E2, Camelia, or ARIR. If the algorithm name is AES, the GF(2 n )Matrix test submodule.

[0192] The binary field matrix test submodule is used to receive a ninth input value, where the ninth input is a coefficient matrix corresponding to the P permutation. When the coefficient matrix is a matrix over the binary field GF(2), the submodule obtains the dimension dim of the coefficient matrix and the element Matrix[enrty][enrty] of the coefficient matrix, calculates and outputs the number of first matrix branches;

[0193] The method for calculating the number of branches of the first matrix includes:

[0194] Step S11: For the input dim dim-dimensional column vector Filling unit vectors e1,...,e dim , we get [X1,...,X dim ,e1,...,e dim ];in, is a dim-dimensional column vector on a binary field, is a dim-dimensional column vector on a binary field;

[0195] Step S12: For [X1,...,X dim ,e1,...,e dim ] are combined and XORed. For 2≤l0≤dim, l0 vectors are selected for XORing. If the XOR value is not 0, l0 is assigned to l0+1 and the process goes to step S12. If the XOR value is 0, the process goes to step S13.

[0196] Step S13: The number of output differential branches is 10.

[0197] The GF(2 n ) matrix test submodule is used to receive the tenth input value, the tenth input is the coefficient matrix corresponding to the P permutation, the coefficient matrix multivariate domain GF(2 n ) on the matrix, then get GF(2 n) domain, the degree n of the irreducible polynomial corresponding to the domain, the array irrp[t] consisting of the coefficients of the irreducible polynomial, the dimension dim of the coefficient matrix, and the element Matrix[MAX][MAX] of the coefficient matrix, and calculate and output the number of branches of the second matrix;

[0198] The method for calculating the number of branches of the second matrix is:

[0199] Step S21: For the input dim dim-dimensional column vectors [X1,...,X dim ],X ip ∈(GF(2 n )) dim ,1≤ip≤dim, fill with unit vectors e1,...,e dim , we get [X1,...,X dim ,e1,...,e dim ]; where GF(2 n ) is the finite field on which P permutation is based, (GF(2 n )) dim is GF(2 n ) domain dim-dimensional vector;

[0200] Step S22: For [X1,...,X dim ,e1,...,e dim ] perform Gaussian elimination on 2*dim vectors. For 2≤l1≤dim, select l1 vectors for Gaussian elimination. If the l1 vectors are linearly independent, assign l1 to l1+1 and go to step S22. Otherwise, go to step S23.

[0201] Step S23: Output the number of differential branches as l1.

[0202] In this embodiment, Figure 3 As shown, the generalized Feistel structure (GFS) is used to test the minimum diffusion round module. The eleventh input data is received, and the eleventh input data is the block number q, which is an even number. The intermediate variable is the permutation δ, that is, for integer q, the permutation δ replaces the odd number to the even number, and the even number to the odd number, so there are a total of permutations, the i-th permutation is denoted as δ i ; Vector Y = [Y0, Y1, ... Y q-1 ], Y is the q-dimensional unit vector e j , e j It is a q-dimensional vector whose j-th component is 1 and the rest of the components are 0 (non-zero symbol is defined as "1", and zero element is still "0").

[0203] The minimum diffusion round number test module is used to test the minimum diffusion round number and the corresponding wire-pulling of the generalized Feistel structure of the symmetric cipher component. The calculation method of the minimum diffusion round number and the corresponding wire-pulling of the generalized Feistel structure of the symmetric cipher component is as follows:

[0204] Receive the eleventh input data, where the eleventh input data is the number of blocks q, and q is an even number. Calculate the eleventh input data and output the minimum diffusion round number r and the corresponding wire-pulling permutation δ. Each round of transformation changes at least one component Y of the input Y j , 0 ≤ j ≤ q - 1. If all components have changed after R rounds, the diffusion round number is R.

[0205] Furthermore, the method for calculating the minimum diffusion round number and the corresponding wire-pulling permutation is as follows:

[0206] Step S31: For the input q, set r = q, and let the permutation δ be δ ii ;

[0207] Step S32: If q alternative diffusion round numbers Re jj have been obtained, enter step S35; otherwise, let Y = [Y0, Y1,... Y q-1 = e jj , where Y0, Y1,... Y q-1 are the q components of Y, and e jj is a q-dimensional vector with the jj-th component being 1 and the remaining components being 0;

[0208] Step S33: Perform the following R-round operation on the input Y = [Y0, Y1,... Y q-1 :

[0209] [Y0, Y1,... Y q-1 keeps the values of the odd positions unchanged, and the even positions are OR-operated with the odd positions to obtain [Y′0, Y′1,... Y′ q-1 ;

[0210] After permutation δ ii move the corresponding blocks of [Y′0, Y′1,... Y′ q-1 to obtain [Z0, Z1,... Z q-1 ;

[0211] Update Y to [Z0, Z1,... Z q-1 ;

[0212] If the q components of [Y0, Y1,... Y q-1 are not all 1, and R < q, then assign R to R + 1 and enter step S33; otherwise, output the alternative diffusion round number Re jj ;

[0213] Step S34: Assign jj as jj + 1, and enter Step S32;

[0214] Step S35: The diffusion round number R = min{Re jj |1 ≤ jj ≤ q}, and output R and the corresponding wire drawing permutation δ ii ;

[0215] Step S36: If R < r, let r = R. If all permutations have not been processed, update the permutation δ to δ ii+1 , clear the number of alternative diffusion round numbers, and enter Step S32; otherwise, output r and the corresponding permutation δ.

[0216] In the present invention, by testing the S - box corresponding to the system symmetric cipher component of the present invention, the security performance tests of S - boxes with scales of 4×4, 6×6, and 8×8 are realized, including: differential uniformity, nonlinearity, number of fixed points, number of algebraic terms, algebraic immunity, avalanche characteristic, diffusion characteristic, algebraic degree, etc. During the test, input the size of the S - box and the specific content of the S - box, click on the required output indicators, and obtain the corresponding indicator outputs. When inputting the content of the S - box, each number should be separated by an English comma.

[0217] By testing the P - permutation corresponding to the system symmetric cipher component of the present invention, 4×4, 8×8, 16×16, and 32×32 binary field matrices and finite field matrices are realized. During the test, matrices over GF(2) field or matrices over GF(2 n ) field can be selected. Input the coefficients, degree, dimension of the matrix, and elements of the matrix in sequence, and output the branch number of the matrix. When inputting the content of the matrix, each number should be separated by an English comma.

[0218] By testing the minimum diffusion round number of the diffusion layer of the system symmetric cipher component of the present invention, the search for the minimum diffusion round numbers of 8 - branch, 12 - branch, and 16 - branch wire drawing layers on the generalized Feistel is realized. During the test, input the test data, and output the minimum diffusion round number and its wire drawing order. When inputting the differential mode, no symbol is required between each number.

[0219] As Figure 4(A)-Figure 4(L) shown.

[0220] First, select the input number base of the S - box, and there are two choices: hexadecimal and decimal;

[0221] Then, input the input and output sizes of the S - box. The input and output sizes should be the same, and the maximum size of both input and output is 8;

[0222] Next, input the content of the S - box, and the number of inputs is 2 n(n is the input and output size of the S-box). Note: When entering the contents of the S-box, the numbers are separated by English commas, and hexadecimal numbers can be entered directly without adding 0X.

[0223] Finally, click Start Evaluation to obtain the S-box differential uniformity, nonlinearity, number of fixed points, number of algebraic terms, algebraic immunity, avalanche characteristics, diffusion characteristics, and algebraic degree. Click the differential distribution table, linear distribution table, detailed description of the number of algebraic terms, detailed description of algebraic immunity, detailed description of avalanche characteristics, and detailed description of diffusion characteristics to obtain detailed descriptions.

[0224] Example 1: Input size of 4-bit S-box: 2, 1, 6, 11, 13, 4, 8, 7, 10, 14, 0, 15, 3, 9, 12, 5.

[0225] (1) Click on the differential distribution table to obtain the result shown in Figure 4(A).

[0226] Excluding the first row, the maximum non-zero value 6 is the differential uniformity of the S-box.

[0227] (2) Click on the linear distribution table to get the result shown in Figure 4(B):

[0228] Excluding the first row, the nonlinearity is 12.

[0229] (3) Click “Detailed description of algebraic terms”, as shown in Figure 4(C).

[0230] (4) Click “Detailed description of algebraic immunity”, as shown in Figure 4(D).

[0231] (5) Click “Avalanche Characteristics Detailed Description”, as shown in Figure 4(E).

[0232] (6) Single indicator and overall evaluation: Check the indicator or all items to be tested, click "Start evaluation" in the lower right corner, and the corresponding indicator or all 8 indicators will be displayed: differential uniformity, nonlinearity, number of fixed points, number of algebraic terms, algebraic immunity, avalanche characteristics, diffusion characteristics, and algebraic degree, as shown in Figure 4(F).

[0233] Diffusion layer P branch number test

[0234] This module has algorithm examples and a test of the number of branches of the matrix corresponding to the diffusion layer P.

[0235] (8) Example demonstration

[0236] The algorithm examples that can be demonstrated include two Feistel structure algorithms E2 and Camellia, and two SP structure algorithms AES and ARIA. Taking AES as an example, select AES and click the "Output" button, as shown in Figure 4(G).

[0237] The MDS matrix of AES is based on GF(2 8 ) element construction, corresponding to the irreducible polynomial m(x)=x 8 +x 4 +x 3 +x+1, so the degree is 8, the coefficient is [100011011], because the order is 4, so the input dimension is 4, the MDS matrix is

[0238]

[0239] The number of output branches, i.e. "results": 5.

[0240] (9) Matrix branch number test

[0241] To test the coefficient matrix on the binary domain, first select "Matrix on F2"; then enter the order of the matrix, such as 8; and then enter the matrix, as shown in Figure 4(H).

[0242] 0,1,1,1,1,0,0,1

[0243] 1,0,1,1,1,1,0,0

[0244] 1,1,0,1,0,1,1,0

[0245] 1,1,1,0,0,0,1,1

[0246] 0,1,1,1,1,1,1,0

[0247] 1,0,1,1,0,1,1,1

[0248] 1,1,0,1,1,0,1,1

[0249] 1,1,1,0,1,1,0,1

[0250] Finally, click "Output" to get the result: 5.

[0251] Minimum diffusion rounds test

[0252] Input n-block data 000...001, such as 8-block input: 00000001, click "Output", and get the output results: all permutations and corresponding diffusion rounds, and the minimum diffusion rounds and wire pulling order. Figure 4(I)-Figure 4(L) shown.

[0253] The present invention provides a method for testing the security of a symmetric cryptographic component, the method being based on the aforementioned system and comprising:

[0254] Testing the cryptographic performance of the S-box of the symmetric cryptographic component; that is, the S-box testing module is used to test the cryptographic performance of the S-box of the symmetric cryptographic component;

[0255] Testing the P permutation performance of the symmetric cryptographic component, i.e., testing the P permutation performance by a P permutation testing module;

[0256] The minimum number of diffusion rounds and the corresponding pull line of the symmetric cryptographic component are tested, that is, the minimum number of diffusion rounds and the corresponding pull line of the generalized Feistel structure of the symmetric cryptographic component are tested by a minimum diffusion round number testing module.

[0257] The above specific embodiments merely illustrate the design principles of the present invention. The shapes and names of the components described herein may vary and are not limiting. Therefore, those skilled in the art may modify or substitute equivalents for the technical solutions described in the above embodiments. Such modifications and substitutions, without departing from the inventive spirit and technical solutions of the present invention, shall fall within the scope of protection of the present invention.

Claims

1. A system for testing the security of a symmetric cryptographic component, characterized in that: include: The S-box test module is used to test the cryptographic performance of the S-box component of the symmetric cryptography. The S-box test module includes a differential uniformity submodule, a nonlinearity submodule, a fixed point number submodule, an algebraic degree and number of terms submodule, an algebraic immunity submodule, an avalanche submodule, and a diffusion submodule; The P permutation test module is used to test the diffusion performance of the symmetric cryptographic component P permutation. The P permutation test module includes a demonstration submodule, a binary domain matrix test submodule, a GF(2 n )Matrix test submodule; Minimum diffusion round test module, used to test the minimum diffusion rounds and corresponding pull lines of the generalized Feistel structure of the symmetric cryptographic component; The minimum diffusion round number test module is used to test the minimum diffusion round number and the corresponding pull line of the generalized Feistel structure of the symmetric cryptographic component; the minimum diffusion round number test module receives an eleventh input data, the eleventh input data is the block number q, and q is an even number; The calculation method of the minimum number of diffusion rounds and the corresponding pull line of the generalized Feistel structure of the symmetric cryptographic component is: Step S31: For input q, let r = q, and let the permutation δ be δ ii ; Step S32: If q candidate diffusion round numbers Re have been obtained jj , go to step S35; otherwise, let Y=[Y0,Y1,…Y q-1 ]=e jj ,Y0,Y1,…Y q-1 is the q components of Y, e jj is a q-dimensional vector whose jj-th component is 1 and the rest are 0; Step S33: Input Y=[Y0, Y1, ... Y q-1 ] Perform the following R-th round of operations: [Y0,Y1,…Y q-1 ]The value of the odd bit remains unchanged, and the even bit is ORed with the odd bit to obtain [Y′0,Y′1,…Y′ q-1 ]; After replacement δ ii Move [Y′0,Y′1,…Y′ q-1 ], we get [Z0,Z1,…Z q-1 ]; Update Y to [Z0,Z1,…Z q-1 ]; If q components of [Y0, Y1, … Y q-1 are not all 1 and R < q, then assign R as R + 1 and go to step S33; otherwise, output the alternative diffusion round number Re jj ; Step S34: assign jj to jj+1 and go to step S32; Step S35: Diffusion round number R = min{Re jj |1≤jj≤q}, and output R and the corresponding wire permutation δ ii ; Step S36: If R < r, let r = R. If not all permutations have been processed, update the permutation δ to δ ii+1 , clear the number of alternative diffusion rounds, and go to Step S32; otherwise, output r and the corresponding permutation δ.

2. The system according to claim 1, wherein The S-box testing module receives the input size, output size, and content of the S-box of the symmetric cryptographic component to be tested, where the input size refers to the number of bits of the input data of the S-box, the output size refers to the number of bits of the output data of the S-box, and the content of the S-box refers to the specific values of the input data and output data of the S-box; the input of the S-box is recorded as the independent variable x, and the output is recorded as the dependent variable y; the S-box of the symmetric cryptographic component to be tested receives the values of the parameters corresponding to the S-box.

3. The system according to claim 2, wherein: The differential uniformity submodule is configured to receive a first input value, the first input value including an input differential of the contents of the S-box, an output differential of the contents of the S-box, an S-box independent variable x, and an S-box dependent variable y; and performing calculation on the received first input value; For each set of values (i, j) of input difference and output difference, traverse the S-box independent variable x and calculate the value Among them, GF(2) n represents an n-dimensional vector on a binary field, represents the exclusive-or operation, || represents the operation on the number of elements, S(x) is the content of the S-box, i is the i-th row of the input difference, j is the j-th column of the output difference, n is the input size of the S-box, and m is the output size of the S-box; Each value of λ obtained ij Fill in the matrix to form the differential distribution table of the S box, that is After removing the first row from the differential distribution table Λ(S) of the S-box, the largest non-zero value among the remaining values is the differential uniformity of the S-box; output the differential distribution table Λ(S) and the differential uniformity of the S-box; The nonlinearity submodule is configured to receive a second input value, the second input value including an S-box input mask, an output mask, an S-box independent variable x, and an S-box dependent variable y, and calculate the received second input value to output a first linear distribution table L1(S), a second linear distribution table L2(S), and a nonlinearity; The calculating the received second input value includes: For each set of values (u, v) of the input mask and the output mask, traverse the S-box argument x and calculate each value in the first linear distribution table L1(S): Among them, GF(2) n represents an n-dimensional vector on a binary field, represents the exclusive-or operation, || represents the operation of the number of elements; S(x) is the content of the S-box, the dot product represents the inner product operation of two vectors, u is the value of the S-box input mask, v is the value of the S-box output mask, n is the S-box input size, and m is the S-box output size; Each value n1 obtained uv Fill in an n×m matrix to form the first linear distribution table of the S-box, that is, For each set of values (u, v) of the input mask and the output mask, traverse the S-box independent variable x and calculate each value in the second linear distribution table L2(S): Among them, GF(2) n represents an n-dimensional vector on a binary field, represents the exclusive OR operation, and || represents the operation of the number of elements; Each value n2 obtained uv Fill in the second n×m matrix to form the second linear distribution table of the S box, that is, The smallest non-zero integer in L1(S) and L2(S) is the S-box nonlinearity, and the first linear distribution table L1(S), the first linear distribution table L2(S) and the S-box nonlinearity are output; The fixed point number submodule is used to receive a third input value, which includes an S-box independent variable x and an S-box dependent variable y, and calculate the received third input value: Traverse the S-box independent variable x and calculate the number t of the corresponding S-box dependent variable y that is equal to x. t=|{x=y,x∈GF(2) n ,y∈GF(2) m }| Among them, GF(2) n and GF(2) m Respectively represent n-dimensional and m-dimensional vectors on binary fields, || represents the operation of the number of elements; The number t where x and y are equal is the number of fixed points of the S-box. Output the number of fixed points of the S-box.

4. The system according to claim 2, wherein: The algebraic degree and number of terms submodule is used to receive a fourth input value, wherein the fourth input value includes an S-box independent variable x and an S-box dependent variable y; Calculate the received fourth input value: Based on the S-box independent variable x and S-box dependent variable y, traverse the S-box independent variable x to obtain the equation group corresponding to each output bit of the S-box. Each equation group contains 2 n equations, solve m Boolean functions f(x) based on m equations; Where x = (x1,…,x n ), x1,…,x n is the n components corresponding to the S-box independent variable x; a0 is the coefficient of the 0th order term, for The coefficient of the term, f(x) is a Boolean function with n-bit input and 1-bit output, The degree of the highest-order term in f(x) is defined as the algebraic degree of f(x), that is, the algebraic degree D(f) is The number of p-order terms in f(x) is called the p-order terms of f(x), and the sum of all terms is called the number of terms of f(x), that is, the algebraic term number N(f) is The S-box dependent variable y is m bits, and the S-box dependent variable y corresponds to m Boolean functions S1(x), S2(x),…, S m (x), combine these m Boolean functions to get all 2 m Boolean functions, the Boolean function with the smallest degree is the S-box algebraic degree, that is Where D is the algebraic degree of the input function corresponding to the S-box, S is the m-component Boolean function output by the S-box, β is the mask output by the S-box, GF(2) m is an m-dimensional vector on a binary field, is the XOR operation, b io is the component of β, β=(b1,…,b m ),io is a variable; The number of terms of the Boolean function with the smallest number of terms is the number of terms of the S-box, that is, Where N is the number of algebraic terms of the input function corresponding to the S-box, β is the output mask of the S-box, GF(2) m is an m-dimensional vector on a binary field, is the XOR operation, b ii is the component of β, β=(b1,…,b m ).

5. The system according to claim 2, wherein: The algebraic immunity submodule is used to receive a fifth input value, the fifth input value including an S-box independent variable x and an S-box dependent variable y, and calculate the received fifth input value to obtain and output algebraic immunity; The calculating the received fifth input value includes: According to the input S-box independent variable x and S-box dependent variable y, we can get the m Boolean expressions S1(x), S2(x),…, S m (x), for every Boolean function S num (x), calculate so that S num (x)g(x)=0 or The minimum algebraic degree of a non-zero Boolean function g(x) that holds true, where 1≤num≤m; Define the Boolean function S num The set of zero operators of (x) is Ann(S num )={g(x)∈B n [x]|S num g=0,g(x)≠0},S num (x) Algebraic Immunity AI(S num )for AI(S num )=min{d|d=deg(g),g∈Ann(S num )∪Ann(S num ⊕1)}, Among them B n [x] represents the set of all n-ary Boolean functions, deg represents the algebraic degree, and g is S num (x) of the zero operator g(x), Ann(S num ) is the set of these zero operators; The S-box dependent variable y is m bits, and the S-box dependent variable y corresponds to m Boolean functions S1(x), S2(x),…, S m (x), combine these m Boolean functions to get all 2 m Boolean functions, replace the AI (β·S) with the smallest algebraic immunity as the S-box algebraic immunity, that is Among them, · represents the inner product operation, and sum is a variable; The avalanche submodule is used to receive a sixth input value, the sixth input value including an S-box independent variable x and an S-box dependent variable y, and perform avalanche characteristic calculation on the sixth input value to obtain and output the avalanche characteristic; The calculating the sixth input value includes: The S-box dependent variable y is m bits, and the S-box dependent variable y corresponds to m Boolean functions S1(x), S2(x),…, S m (x), change 1 bit of the input, e is an n-dimensional unit vector, traverse the S-box independent variable x, S num (x) is a Boolean function, calculating m S num The output of (x) is the number of bits that have changed compared to the unchanged input, that is: Among them, GF(2) n represents an n-dimensional vector on a binary field, Indicates exclusive OR operation, W H (e) represents the number of non-zero bits in the variable e; like Then the S-box satisfies the avalanche criterion; otherwise, it is determined that the S-box does not satisfy the avalanche criterion; The diffusion submodule is used to receive a seventh input value, the seventh input value including an S-box independent variable x and an S-box dependent variable y, and calculate the received seventh input value to obtain and output a diffusion characteristic; The calculating the received seventh input value includes: According to the input S-box independent variable x and S-box dependent variable y, we can get the m Boolean expressions S1(x), S2(x),…, S m (x), for each Boolean function, traverse the S-box variable x, for each sum, 1≤sum≤m, judge Is it a balanced function? α∈GF(2) n :1≤W H (a)≤k Among them, GF(2) n represents an n-dimensional vector on a binary field, Indicates exclusive OR operation, W H (α) represents the number of non-zero bits in the variable α, and k is the number of bits such that Balanced W H (α) maximum value; For each sum, 1≤sum≤m, if each If both are equilibrium functions, then the S-box satisfies the k-times diffusion criterion; otherwise, the S-box does not satisfy the k-times diffusion criterion.

6. The system according to claim 2, wherein: The P permutation test module includes a demonstration submodule, a binary domain matrix test submodule, a GF(2 n )Matrix test submodule, where: The demonstration submodule is used to demonstrate the branch number test of P permutation, receive an eighth input value, and the eighth input value is an algorithm name, and trigger the binary domain matrix test submodule or the GF(2 n ) Matrix test submodule and display the results; The binary field matrix test submodule is used to receive a ninth input value, where the ninth input is a coefficient matrix corresponding to the P permutation. When the coefficient matrix is a matrix over the binary field GF(2), the submodule obtains the dimension dim of the coefficient matrix and the element Matrix[enrty][enrty] of the coefficient matrix, calculates and outputs the number of first matrix branches; The calculating of the number of branches of the first matrix includes: Step S11: For the input dim dim-dimensional column vector Filling unit vectors e1,...,e dim , we get [X1,...,X dim ,e1,...,e dim ];in, is a dim-dimensional column vector on a binary field, is a dim-dimensional column vector on a binary field; Step S12: For [X1,...,X dim ,e1,...,e dim ] are combined and XORed. For 2≤l0≤dim, l0 vectors are selected for XORing. If the XOR value is not 0, l0 is assigned to l0+1 and the process goes to step S12. If the XOR value is 0, the process goes to step S13. Step S13: Output the number of differential branches to 10; The GF(2 n ) matrix test submodule is used to receive the tenth input value, the tenth input is the coefficient matrix corresponding to the P permutation, the coefficient matrix multivariate domain GF(2 n ) on the matrix, then get GF(2 n ) domain, the degree n of the irreducible polynomial corresponding to the domain, the array irrp[t] consisting of the coefficients of the irreducible polynomial, the dimension dim of the coefficient matrix, and the element Matrix[MAX][MAX] of the coefficient matrix, and calculate and output the number of branches of the second matrix; The calculation to obtain the number of branches of the second matrix includes: Step S21: For the input dim dim-dimensional column vectors [X1,...,X dim ],X ip ∈(GF(2 n )) dim ,1≤ip≤dim, fill with unit vectors e1,...,e dim , we get [X1,...,X dim ,e1,...,e dim ]; where GF(2 n ) is the finite field on which P permutation is based, (GF(2 n )) dim is GF(2 n ) domain dim-dimensional vector; Step S22: For [X1,...,X dim ,e1,...,e dim ] perform Gaussian elimination on 2*dim vectors. For 2≤l1≤dim, select l1 vectors for Gaussian elimination. If the l1 vectors are linearly independent, assign l1 to l1+1 and go to step S22. Otherwise, go to step S23. Step S23: Output the number of differential branches as l1.

7. A method for testing the security of a symmetric cryptographic component, the method being based on the system according to any one of claims 1 to 6, characterized in that: include: Testing the cryptographic performance of the S-box of the symmetric cryptographic component; that is, the S-box testing module is used to test the cryptographic performance of the S-box of the symmetric cryptographic component; Testing the P permutation performance of the symmetric cryptographic component, i.e., testing the P permutation performance by a P permutation testing module; The minimum number of diffusion rounds and the corresponding pull line of the symmetric cryptographic component are tested, that is, the minimum number of diffusion rounds and the corresponding pull line of the generalized Feistel structure of the symmetric cryptographic component are tested by a minimum diffusion round number testing module.

Images